Certificates & Keys

Key formats and keys

• The .cer format is used for installing CA certificates into a browser.
• Installing CA Certificates into various browsers -- WW University
• Installing Keys/Certs into MacOSX IE Browser
• JavaCA tool
• Configuring a local CA
• Configuring STARTTLS for Sendmail
• Configuring Sendmail's STARTTLS (SSL) and Relaying
• Certificate Management and Installation with OpenSSL
• Introduction to LDAP -- An Ancient LDAP Tutorial
• Michael Yee's LDAP Overview
• SSLeay Certificate Cookbook -- (old, find openssh version)
• SSL Certificates HOWTO
• Keys / Certificates used by servers don't have passwords, because that would make them near impossible to use; you would need to distribute the password to allow access, which would not allow automation -- or require a readable key password to be availabe to compromise security.
• Creating a Certificate Authority
• OpenSSL Self-signed Test Certificates
• OpenSSL Certificate Authority Setup
• The CN (common name) of a server is the name used to access that service, not necessarily the actual name of the host performing the service. For example, say you have www load shared across five servers www1 ... www5; each would have the key for www.
• OpenSSL Command-Line HOWTO (including foreign CA ships)

Notes on creating ssl keys for spamc/spamd -- from spamassassin wiki

rm -rf /etc/mail/spamassassin/certs
mkdir -p /etc/mail/spamassassin/certs
(
cd /etc/mail/spamassassin/certs
openssl genrsa 2048 > ca-key.pem
openssl req -new -x509 -nodes -days 1000 -key ca-key.pem > ca-cert.pem
openssl req -newkey rsa:2048 -days 1000 \
	-nodes -keyout server-key.pem > server-req.pem
[enter whatever random data you feel like]
openssl x509 -req -in server-req.pem -days 1000 \
	-CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
)

Local Key Infrastructure